Analysis
-
max time kernel
1201s -
max time network
1202s -
platform
windows7_x64 -
resource
win7-en-20211014 -
submitted
01-11-2021 18:15
Static task
static1
Behavioral task
behavioral1
Sample
Setup.exe
Resource
win7-en-20211014
windows7_x64
0 signatures
0 seconds
Behavioral task
behavioral2
Sample
Setup.exe
Resource
win10-en-20210920
formbookmetasploitraccoonredlinesmokeloadersocelarsvidarxloaderzloader5043d5e3b118376f4c4ca4eae396c30af7ffb9898dec62c1db2959619dca43e02fa46ad7bd606400937dsd1s0iwbackdoorbotnetdiscoveryevasioninfostealerloaderpersistenceratspywarestealerthemidatrojanupx
windows10_x64
0 signatures
0 seconds
General
-
Target
Setup.exe
-
Size
403KB
-
MD5
d1b2c8ddca2f8dd02e2c132153055084
-
SHA1
21c011ac7406eef048c175f5887e4eb885c050d6
-
SHA256
506c2f513d64242fcb20ccff8c26c0ed1755fe9120b984c29ba224b311d635c3
-
SHA512
ab73df911df41235159341cc8fefed284a3f9720f241b51dfe2db2ac415b3438d5fbbeacfa980a61d402edc64afeda87447ccda49b7d279fba524036e9287594
Malware Config
Signatures
-
Downloads MZ/PE file
-
Executes dropped EXE 1 IoCs
pid Process 1808 FccSxY_k25POfyxBYrrT80qo.exe -
Checks computer location settings 2 TTPs 1 IoCs
Looks up country code configured in the registry, likely geofence.
description ioc Process Key value queried \REGISTRY\USER\S-1-5-21-2955169046-2371869340-1800780948-1000\Control Panel\International\Geo\Nation Setup.exe -
Loads dropped DLL 1 IoCs
pid Process 1088 Setup.exe -
Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
-
Looks up external IP address via web service 2 IoCs
Uses a legitimate IP lookup service to find the infected system's external IP.
flow ioc 14 ipinfo.io 15 ipinfo.io -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.
-
Program crash 1 IoCs
pid pid_target Process procid_target 1912 1088 WerFault.exe 16 -
Suspicious behavior: EnumeratesProcesses 64 IoCs
pid Process 1088 Setup.exe 1808 FccSxY_k25POfyxBYrrT80qo.exe 1808 FccSxY_k25POfyxBYrrT80qo.exe 1808 FccSxY_k25POfyxBYrrT80qo.exe 1808 FccSxY_k25POfyxBYrrT80qo.exe 1808 FccSxY_k25POfyxBYrrT80qo.exe 1808 FccSxY_k25POfyxBYrrT80qo.exe 1808 FccSxY_k25POfyxBYrrT80qo.exe 1808 FccSxY_k25POfyxBYrrT80qo.exe 1808 FccSxY_k25POfyxBYrrT80qo.exe 1808 FccSxY_k25POfyxBYrrT80qo.exe 1808 FccSxY_k25POfyxBYrrT80qo.exe 1808 FccSxY_k25POfyxBYrrT80qo.exe 1808 FccSxY_k25POfyxBYrrT80qo.exe 1808 FccSxY_k25POfyxBYrrT80qo.exe 1808 FccSxY_k25POfyxBYrrT80qo.exe 1808 FccSxY_k25POfyxBYrrT80qo.exe 1808 FccSxY_k25POfyxBYrrT80qo.exe 1808 FccSxY_k25POfyxBYrrT80qo.exe 1808 FccSxY_k25POfyxBYrrT80qo.exe 1808 FccSxY_k25POfyxBYrrT80qo.exe 1808 FccSxY_k25POfyxBYrrT80qo.exe 1808 FccSxY_k25POfyxBYrrT80qo.exe 1808 FccSxY_k25POfyxBYrrT80qo.exe 1808 FccSxY_k25POfyxBYrrT80qo.exe 1808 FccSxY_k25POfyxBYrrT80qo.exe 1808 FccSxY_k25POfyxBYrrT80qo.exe 1808 FccSxY_k25POfyxBYrrT80qo.exe 1808 FccSxY_k25POfyxBYrrT80qo.exe 1808 FccSxY_k25POfyxBYrrT80qo.exe 1808 FccSxY_k25POfyxBYrrT80qo.exe 1808 FccSxY_k25POfyxBYrrT80qo.exe 1912 WerFault.exe 1912 WerFault.exe 1912 WerFault.exe 1912 WerFault.exe 1912 WerFault.exe 1808 FccSxY_k25POfyxBYrrT80qo.exe 1808 FccSxY_k25POfyxBYrrT80qo.exe 1808 FccSxY_k25POfyxBYrrT80qo.exe 1808 FccSxY_k25POfyxBYrrT80qo.exe 1808 FccSxY_k25POfyxBYrrT80qo.exe 1808 FccSxY_k25POfyxBYrrT80qo.exe 1808 FccSxY_k25POfyxBYrrT80qo.exe 1808 FccSxY_k25POfyxBYrrT80qo.exe 1808 FccSxY_k25POfyxBYrrT80qo.exe 1808 FccSxY_k25POfyxBYrrT80qo.exe 1808 FccSxY_k25POfyxBYrrT80qo.exe 1808 FccSxY_k25POfyxBYrrT80qo.exe 1808 FccSxY_k25POfyxBYrrT80qo.exe 1808 FccSxY_k25POfyxBYrrT80qo.exe 1808 FccSxY_k25POfyxBYrrT80qo.exe 1808 FccSxY_k25POfyxBYrrT80qo.exe 1808 FccSxY_k25POfyxBYrrT80qo.exe 1808 FccSxY_k25POfyxBYrrT80qo.exe 1808 FccSxY_k25POfyxBYrrT80qo.exe 1808 FccSxY_k25POfyxBYrrT80qo.exe 1808 FccSxY_k25POfyxBYrrT80qo.exe 1808 FccSxY_k25POfyxBYrrT80qo.exe 1808 FccSxY_k25POfyxBYrrT80qo.exe 1808 FccSxY_k25POfyxBYrrT80qo.exe 1808 FccSxY_k25POfyxBYrrT80qo.exe 1808 FccSxY_k25POfyxBYrrT80qo.exe 1808 FccSxY_k25POfyxBYrrT80qo.exe -
Suspicious behavior: GetForegroundWindowSpam 1 IoCs
pid Process 1912 WerFault.exe -
Suspicious use of AdjustPrivilegeToken 1 IoCs
description pid Process Token: SeDebugPrivilege 1912 WerFault.exe -
Suspicious use of WriteProcessMemory 8 IoCs
description pid Process procid_target PID 1088 wrote to memory of 1808 1088 Setup.exe 30 PID 1088 wrote to memory of 1808 1088 Setup.exe 30 PID 1088 wrote to memory of 1808 1088 Setup.exe 30 PID 1088 wrote to memory of 1808 1088 Setup.exe 30 PID 1088 wrote to memory of 1912 1088 Setup.exe 31 PID 1088 wrote to memory of 1912 1088 Setup.exe 31 PID 1088 wrote to memory of 1912 1088 Setup.exe 31 PID 1088 wrote to memory of 1912 1088 Setup.exe 31
Processes
-
C:\Users\Admin\AppData\Local\Temp\Setup.exe"C:\Users\Admin\AppData\Local\Temp\Setup.exe"1⤵
- Checks computer location settings
- Loads dropped DLL
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:1088 -
C:\Users\Admin\Pictures\Adobe Films\FccSxY_k25POfyxBYrrT80qo.exe"C:\Users\Admin\Pictures\Adobe Films\FccSxY_k25POfyxBYrrT80qo.exe"2⤵
- Executes dropped EXE
- Suspicious behavior: EnumeratesProcesses
PID:1808
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 1088 -s 14642⤵
- Program crash
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of AdjustPrivilegeToken
PID:1912
-